Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-25 Thread Rainer Gerhards 
Let's take a simple approach: try 8.34. If it has a problem, let us
know and I see that can look at it.

IIRC I was refering to this issue and associated fix:
https://www.rsyslog.com/remote-syslog-pri-vulnerability/

given the age, it should probably be available since 8.4.2. But again,
I don't remember that old stuff. Doesn't make sense to look more at
it, it just block me from doing work to move forward. If you need the
old cruft, consider opening a bug report with Ubunutu or purchasing
professional support.

Again, if the issues exists in 8.34 let me know.

Rainer

2018-04-25 9:30 GMT+02:00 David Lang <da...@lang.hm>:
> 8.16 was 3 years ago, so it's not going to be a 'recent' version.
>
> I am not sure what feature Rainer is talking about either, but I would start
> looking at the current documentation, starting with the function list and
> the property replacer capablities.
>
> Or you can detect the situation and have an if statement to use a different
> template that hard-codes the fix.
>
> look at exactly what is contained in every variable by logging a few
> messages with RSYSLOG_DebugFormat
>
> And if you aren't going to be willing to replace your LTS version with a
> current version, the template approach is all you are going to be able to
> do, and you will need to check the docs shipped with that version, as the
> current docs will include a lot of things that your version won't
>
> David Lang
>
>  On Wed, 25 Apr 2018, Simon Lundström wrote:
>
>> Date: Wed, 25 Apr 2018 09:19:19 +0200
>>
>> From: Simon Lundström <si...@su.se>
>> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
>> To: rsyslog-users <rsyslog@lists.adiscon.com>
>> Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI
>>
>> Ah, I'm sorry I wasn't clear. We're only running Ubuntu LTSes so  8.16.0
>> is the highest version which an LTS supports.
>>
>> I'm not yet sure what the feature is, I've seen no documentation of it and
>> I don't know what it's called even. I can't find anything when searching for
>> "rsyslog replace capability".
>>
>> What is this feature called so I can search for it? Or what is it called
>> in the code so I can see when it was implemented?
>>
>> BR,
>> - Simon
>>
>> On Wed, 2018-04-25 at 00:04:03 -0700, David Lang wrote:
>>>
>>> that list includes versions going back 6 years, which are not going to
>>> have the features.
>>>
>>> Test with the latest 8.34 version, and if you get everything working to
>>> your satsfaction, you can either see which of the other versions support the
>>> needed features, or upgrade your systems to the current version
>>>
>>> David Lang
>>>
>>> On Wed, 25 Apr 2018, Simon Lundström wrote:
>>>
>>>> Date: Wed, 25 Apr 2018 08:32:34 +0200
>>>> From: Simon Lundström <si...@su.se>
>>>> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>> To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>> Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI
>>>>
>>>> Any idea how to use the replace capability, automatic or not, in the
>>>> versions specified at the ubuntu page below?
>>>>
>>>> BR,
>>>> - Simon
>>>>
>>>> On Mon, 2018-04-23 at 08:34:11 +0200, Simon Lundström wrote:
>>>>>
>>>>> On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:
>>>>>>
>>>>>> which rsyslog version do you have? I think current ones have an
>>>>>> automatic replace capability, but I am not 100% sure.
>>>>>
>>>>>
>>>>> That wildly differs, but everything available in Ubuntu e.g, so that's
>>>>> everything listed here: <https://launchpad.net/ubuntu/+source/rsyslog/>
>>>>>
>>>>> BR,
>>>>> - Simon
>>>>>
>>>>>> 2018-04-20 10:32 GMT+02:00 Simon Lundström <si...@su.se>:
>>>>>>>
>>>>>>> Hey all!
>>>>>>>
>>>>>>> We have some devices which can't be easily fixed which uses an
>>>>>>> invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
>>>>>>> 2018-04-20T10:19:49.973793+02:00 central.syslog.server
>>>>>>> 2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
>>>>>>> 10:19:49 server.which.syslogged program: message
>>>>>>>
>>>>>>> Is it possible for rsysl

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-25 Thread David Lang 

8.16 was 3 years ago, so it's not going to be a 'recent' version.

I am not sure what feature Rainer is talking about either, but I would start 
looking at the current documentation, starting with the function list and the 
property replacer capablities.


Or you can detect the situation and have an if statement to use a different 
template that hard-codes the fix.


look at exactly what is contained in every variable by logging a few messages 
with RSYSLOG_DebugFormat


And if you aren't going to be willing to replace your LTS version with a current 
version, the template approach is all you are going to be able to do, and you 
will need to check the docs shipped with that version, as the current docs will 
include a lot of things that your version won't


David Lang

 On Wed, 25 Apr 2018, Simon Lundström wrote:


Date: Wed, 25 Apr 2018 09:19:19 +0200
From: Simon Lundström <si...@su.se>
Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI

Ah, I'm sorry I wasn't clear. We're only running Ubuntu LTSes so  8.16.0 is 
the highest version which an LTS supports.


I'm not yet sure what the feature is, I've seen no documentation of it and I 
don't know what it's called even. I can't find anything when searching for 
"rsyslog replace capability".


What is this feature called so I can search for it? Or what is it called in 
the code so I can see when it was implemented?


BR,
- Simon

On Wed, 2018-04-25 at 00:04:03 -0700, David Lang wrote:
that list includes versions going back 6 years, which are not going to have 
the features.


Test with the latest 8.34 version, and if you get everything working to 
your satsfaction, you can either see which of the other versions support 
the needed features, or upgrade your systems to the current version


David Lang

On Wed, 25 Apr 2018, Simon Lundström wrote:


Date: Wed, 25 Apr 2018 08:32:34 +0200
From: Simon Lundström <si...@su.se>
Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI

Any idea how to use the replace capability, automatic or not, in the 
versions specified at the ubuntu page below?


BR,
- Simon

On Mon, 2018-04-23 at 08:34:11 +0200, Simon Lundström wrote:

On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:

which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.


That wildly differs, but everything available in Ubuntu e.g, so that's 
everything listed here: <https://launchpad.net/ubuntu/+source/rsyslog/>


BR,
- Simon


2018-04-20 10:32 GMT+02:00 Simon Lundström <si...@su.se>:

Hey all!

We have some devices which can't be easily fixed which uses an
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
2018-04-20T10:19:49.973793+02:00 central.syslog.server
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
10:19:49 server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of 
"reporting"

it.
Can "central.syslog.server" do it? Or must "server.which.syslogged" do 
it?


Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a 
myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
DON'T

LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad 
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
DON'T LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad 
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
DON'T LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad 
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
DON'T LIKE THAT.



___
rsyslog mailing list
http://lists.adiscon.net/mailman

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-25 Thread Simon Lundström 
Ah, I'm sorry I wasn't clear. We're only running Ubuntu LTSes so  8.16.0 
is the highest version which an LTS supports.


I'm not yet sure what the feature is, I've seen no documentation of it 
and I don't know what it's called even. I can't find anything when 
searching for "rsyslog replace capability".


What is this feature called so I can search for it? Or what is it called 
in the code so I can see when it was implemented?


BR,
- Simon

On Wed, 2018-04-25 at 00:04:03 -0700, David Lang wrote:
that list includes versions going back 6 years, which are not going to 
have the features.


Test with the latest 8.34 version, and if you get everything working 
to your satsfaction, you can either see which of the other versions 
support the needed features, or upgrade your systems to the current 
version


David Lang

On Wed, 25 Apr 2018, Simon Lundström wrote:


Date: Wed, 25 Apr 2018 08:32:34 +0200
From: Simon Lundström <si...@su.se>
Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI

Any idea how to use the replace capability, automatic or not, in the 
versions specified at the ubuntu page below?


BR,
- Simon

On Mon, 2018-04-23 at 08:34:11 +0200, Simon Lundström wrote:

On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:

which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.


That wildly differs, but everything available in Ubuntu e.g, so 
that's everything listed here: 
<https://launchpad.net/ubuntu/+source/rsyslog/>


BR,
- Simon


2018-04-20 10:32 GMT+02:00 Simon Lundström <si...@su.se>:

Hey all!

We have some devices which can't be easily fixed which uses an
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
2018-04-20T10:19:49.973793+02:00 central.syslog.server
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
10:19:49 server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of "reporting"
it.
Can "central.syslog.server" do it? Or must 
"server.which.syslogged" do it?


Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED 
by a myriad of

sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by 
a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO 
NOT POST if you DON'T LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a 
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT 
POST if you DON'T LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a 
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT 
POST if you DON'T LIKE THAT.



___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-25 Thread David Lang 
that list includes versions going back 6 years, which are not going to have the 
features.


Test with the latest 8.34 version, and if you get everything working to your 
satsfaction, you can either see which of the other versions support the needed 
features, or upgrade your systems to the current version


David Lang

 On Wed, 25 Apr 2018, 
Simon Lundström wrote:



Date: Wed, 25 Apr 2018 08:32:34 +0200
From: Simon Lundström <si...@su.se>
Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Avoid invld PRI and force a valid PRI

Any idea how to use the replace capability, automatic or not, in the versions 
specified at the ubuntu page below?


BR,
- Simon

On Mon, 2018-04-23 at 08:34:11 +0200, Simon Lundström wrote:

On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:

which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.


That wildly differs, but everything available in Ubuntu e.g, so that's 
everything listed here: <https://launchpad.net/ubuntu/+source/rsyslog/>


BR,
- Simon


2018-04-20 10:32 GMT+02:00 Simon Lundström <si...@su.se>:

Hey all!

We have some devices which can't be easily fixed which uses an
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
2018-04-20T10:19:49.973793+02:00 central.syslog.server
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
10:19:49 server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of "reporting"
it.
Can "central.syslog.server" do it? Or must "server.which.syslogged" do 
it?


Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad 
of

sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad 
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you 
DON'T LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
LIKE THAT.



___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-25 Thread Simon Lundström 
Any idea how to use the replace capability, automatic or not, in the 
versions specified at the ubuntu page below?


BR,
- Simon

On Mon, 2018-04-23 at 08:34:11 +0200, Simon Lundström wrote:

On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:

which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.


That wildly differs, but everything available in Ubuntu e.g, so that's 
everything listed here: 



BR,
- Simon


2018-04-20 10:32 GMT+02:00 Simon Lundström :

Hey all!

We have some devices which can't be easily fixed which uses an
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
2018-04-20T10:19:49.973793+02:00 central.syslog.server
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
10:19:49 server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of "reporting"
it.
Can "central.syslog.server" do it? Or must "server.which.syslogged" do it?

Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-23 Thread Simon Lundström 

On Fri, 2018-04-20 at 10:53:46 +0200, Rainer Gerhards wrote:

which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.


That wildly differs, but everything available in Ubuntu e.g, so that's 
everything listed here: 


BR,
- Simon


2018-04-20 10:32 GMT+02:00 Simon Lundström :

Hey all!

We have some devices which can't be easily fixed which uses an
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
2018-04-20T10:19:49.973793+02:00 central.syslog.server
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
10:19:49 server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of "reporting"
it.
Can "central.syslog.server" do it? Or must "server.which.syslogged" do it?

Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] Avoid invld PRI and force a valid PRI

2018-04-20 Thread Rainer Gerhards 
which rsyslog version do you have? I think current ones have an
automatic replace capability, but I am not 100% sure.

Rainer

2018-04-20 10:32 GMT+02:00 Simon Lundström :
> Hey all!
>
> We have some devices which can't be easily fixed which uses an
> invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:
> 2018-04-20T10:19:49.973793+02:00 central.syslog.server
> 2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20
> 10:19:49 server.which.syslogged program: message
>
> Is it possible for rsyslog just to set a valid PRI instead of "reporting"
> it.
> Can "central.syslog.server" do it? Or must "server.which.syslogged" do it?
>
> Thanks!
>
> BR,
> - Simon
> ___
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

[rsyslog] Avoid invld PRI and force a valid PRI

2018-04-20 Thread Simon Lundström 

Hey all!

We have some devices which can't be easily fixed which uses an 
invalid/incorrect syslog PRI. rsyslogd sets these as  e.g.:

2018-04-20T10:19:49.973793+02:00 central.syslog.server  
2018-04-20T10:19:49+02:00 server.which.syslogged  <198>Apr 20 10:19:49 
server.which.syslogged program: message

Is it possible for rsyslog just to set a valid PRI instead of 
"reporting" it.
Can "central.syslog.server" do it? Or must "server.which.syslogged" do 
it?


Thanks!

BR,
- Simon
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.